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The presented article attempts to characterize the encryption dynamics of delayed dynamics based block ciphers, designed for the 
encryption of binary data. For such encryption algorithms, the encryption process relies on a coupling dynamics with time delay 
between different bits in the plaintext (i.e. the "initial" message to be encrypted). Here, the principal dynamics of the encryption 
process is examined and the Hammingdistance is used to quantify the change in ciphertext (i.e. the plaintext after encryption) upon 
changing a single bit in the plaintext message or slightly perturbing the key used during encryption. More precisely, the previously 
proposed "encryption via delayed dynamics" (in short: EDDy) algorithm as well as its extended version (termed ExEDDy) are 
analyzed by means of numerical simulations. As a result it is found that while EDDy exhibits a rather poor perfomance, ExEDDy 
performes considerably better and hence constitutes a significant improvement over EDDy. Consequently, the results are contrasted 
with those obtained for a block cipher that implements the encryption/decryption dynamics by means of reversible cellular automata. 
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1. Introduction 

Cryptography (Greek: kryptos — hidden/secret, grdphein = 
writing) is the science of keeping information secure, e.g. for 
the purpose of secret communication Jit] . In recent years it was 
realized that elementary, computer-science or physics moti- 
vated systems that exhibit a complex behavior allow for the de- 
sign of cryptosystems, i.e. encryption algorithms (also termed 
ciphers) and their decryption counterparts. Among those "ap- 
plied science" encryption algorithms one can distinguish stream 
ciphers that encrypt a given message one bit (or symbol) at a 
time , and block ciphers that operate on blocks of, say, N 

;wts 

The basic task in cryptography is two-fold: (i) the encryption 
process, wherein a plaintext message is scrambled using a cer- 
tain cipher and key. The key specifies the precise way a given 
plaintext is transformed by means of the cipher. The result of 
the encryption procedure is a ciphertext message, (ii) the de- 
cryption process, where the ciphertext is transformed into the 
initial plaintext message by use of the corresponding decryp- 
tion algorithm and a proper key. Note that, depending on the 
precise cryptography-mode, there is a subtle difference regard- 
ing the key: in symmetric -key cryptography, where one deals 
with a single-key cryptosystem, the same key is used during 
encryption/decryption. In public-key cryptography, signifying 
a two-key cryptosystem, the encryption key is public and the 
decryption key is kept secret. A statement on the security of a 
cryptographic method is provided by "Kerckhoffs principle". It 
states that a cryptosystem should be secure if everything about 
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the cryptographic method is known, except the key. Here, se- 
cure means that it is difficult or even impossible to obtain the 
plaintext from the ciphertext. In this regard, a characteristic de- 
sirable for any cipher is that a change in plaintext or key, as 
tiny as it may be, will result in a notable change in the cipher- 
text. More precise, changing one randomly chosen bit in either, 
plaintext or key, should invert nearly half of the bits of the ci- 
phertext. This avalanche property was suggested by Feistel in 
1973 0]. 

Subsequently, only symmetric -key block ciphers designed to 
process binary plaintext messages will be considered. As re- 
gards this, the bulk of the presented article is dedicated to a 
scrambling scheme that relies on the paradigm of "encryption 
via delayed dynamics" (termed EDDy), see [5], as well as an 
extended variant thereof (signified as ExEDDy), see J3]. In Ref. 

it was shown, how an exemplary initial state evolves with 
time and found that encoded states at different iteration times 
of the encryption dynamics are rather uncorrected. Further, 
the effect of a slight modification of the key on the ciphertext 
was illustrated for one plaintext message and concluded that a 
"nearly" correct guess of the key does not lead to a sufficient 
overlap between decoded ciphertext and plaintext upon decryp- 
tion so as to guess the initial message. As a weakness of the 
method it was mentioned that a change of multiple bits in the 
plaintext propagates to the ciphertext as a simple superposition 
of changes due to each changed bit. In Ref. [4] the encryption 
dynamics was modified to some extend, and it was observed 
that a minor change in key leads to rather uncorrected cipher- 
text messages and that a change of multiple bits in plaintext 
does not propagate to the ciphertext as a simple superposition 
of changes due to each changed bit. 
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Figure 1 : Illustration of the encryption dynamics for the cryptosystems under 
consideration. All three ciphers were used to encode the same N = 16-bit plain- 
text message m (leftmost column) for a number of 80 iteration steps (bits with 
value 1 are shown as nonfilled squares), (a) Encryption via delayed dynamics 
(EDDy) cipher, (b) extended EDDy (i.e. ExEDDy) cipher using the same key 
as in (a), and (c) reversible cellular automaton (ReCA) cipher using a randomly 
generated 32-bit update rule. 

The presented article addresses the question of performance 
of the two ciphers using numerical simulations. Basically 
speaking, the encryption algorithms are applied to binary plain- 
texts of N = 4 . . . 2048 bits in length and it is checked whether 
they exhibit the avalanche property. Albeit there are more strict 
criteria to quantify the security of ciphers, I will solely con- 
sider the avalanche property. As it appears, EDDy does not 
exhibit the avalanche property. Even worse, it also lacks com- 
pleteness. Completeness requires that for every possible key, 
every ciphertext bit must depend on all plaintext bits, not only 
a proper subset of those. Further, I present clear evidence that 
ExEDDy outperforms EDDy. So as to put the arguments along 
the plot of the presented article on solid ground, a third, only 
recently introduced, cryptosystem based on reversible cellular 
automata (referred to as ReCA) as presented in [6] is consid- 
ered and the results obtained therein are partly reproduced to 
contrast those for (Ex)EDDy. The encryption algorithms con- 
sidered here all work in iterative manner. As regards this, Fig. 
Q] gives a qualitative account of the difference in the respective 
encryption dynamics. 

Note that only few is known about the performance of re- 
versible cellular automata based block ciphers fla] and even less 
is known on the performance of delayed dynamics based ci- 
phers such as EDDy and ExEDDy. To the best knowledge of the 
author, the presented article comprises a first attempt to quan- 
tify how well the delayed dynamics based ciphers EDDy and 
ExEDDy perform upon encrypting plaintexts of = 4 ... 2018 
bits in length. 

The remainder of the presented article is organized as fol- 
lows. In section|2] the considered cryptosystems are introduced 
and illustrated in more detail. Section [3] contains the numer- 
ical results obtained via simulations for plaintext of different 
size and section|4]concludes with a summary. A more elaborate 



summary of the presented article is available at the papercore 
database Jit]. 

2. Encryption algorithms 

Dynamical rules that describe the evolution of simple system 
often induce complex behavior with characteristics that are de- 
sirable for an encryption scheme [9, 3. 1 1011 . In this regard, the 
remainder of this section describes three cryptographic meth- 
ods that rely on iterative dynamic procedures, exhibiting com- 
plex behavior, used to scramble a binary input message so as to 
hide its information content. 

2.1. EDDy: encryption via delayed dynamics 

Based on the paradigm of delayed dynamics, a block cipher 
for encryption of binary data, here termed EDDy (as in "en- 
cryption with delayed dynamics"), was proposed [5]. EDDy is 
a symmetric-key cryptosystem that works in an iterative manner 
and as such it requires the following input: (i) a binary plain- 
text message m = s(Q), consisting of a sequence of N bits 5,(0) 
(taking values +1), and (ii) a key K - (P,r,T), used during 
the encryption/decryption process. The component P signifies 
a permutation obtained from the sequence (0, 1, ... ,N - 1), t 
represents a delay-time vector of length N, where t, e [ 1 , T max ] 
is an integer delay time associated with bit i, and T denotes the 
number of iterations carried out by the encryption algorithm. 
Note that the key required by EDDy is rather large: if we aim 
to encrypt a A^-bit plaintext message and agree to use an in- 
tegral data type that requires M-bits in order to represent the 
components of P and t as well as T, then the key has a length 
of M(2N +1) bits (bear in mind that the common C/C++- data 
type int has 32 bits). Now, from the point of view of an adver- 
sary that plans a cryptographic attack on EDDy, assume r max 
is known. If the attack merely consists in guessing a key, then 
there are as much as (N\)(T msix ) N possible choices for a pair of 
P and t, as well as a guess for T, left. Hence, the key space of 
EDDy is enormous. For comparison: the data encryption stan- 
dard (DES) which is restricted to a blocksize of 64 bits employs 
a 56 bit key. For fixed N - 6A and r max = 10, there are as much 
as (Nl)(T lmx ) N * 2 500 keys for the EDDy scheme. 

Based on the ingredients above, the encryption dynamics 
read: 

Sj(t) = -s Pj (max(0, t - t,)) (1) 

Therein, P, and r, are the /th elements of P and r, respectively. 
One iteration of the cipher consists in updating each bit once. 
The ciphertext c = s(T) is obtained when the exact number of 
iterations T, predefined in the key, are carried out. Decryption 
is performed by using the same key K and applying the reverse 
dynamics Sk(t) = -s u (t + T u ), where P„ = k. So as to facilitate a 
proper decryption, the sender needs to communicate a sequence 
of at least r max + 1 successive encoded states, i.e. the "full" ci- 
phertext cp, to the receiver. An exemplary encryption procedure 
for a plaintext of 8-bit in length is shown in Fig. [2ja). In effect, 
the dynamics defined by the updating rule Eq.Q]induces a lin- 
ear dynamics. The state of a particular bit, say bit i, is related to 
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Figure 2: Illustration of the encryption process for a 8-bit plaintext message 
m = [-1,1,-1, 1,-1, 1,-1,-1] (bits in state 1 are given by nonfilled squares) 
and key K = (P, r, T) in case of (a) the EDDy cipher, and (b) the ExEDDy 
cipher. In the latter figure, plaintext m, ciphertext c and full ciphertext cp are 
indicated. Figure (c) shows the encryption process for the ReCA cipher using 
plaintext m = [0, 1,0, 1,0, 1,0,0] and key K = (R, T). 



the state of exactly one other bit with integer identifier j - Pj 
at some preceding time. 

2.2. ExEDDy: extended variant of encryption via delayed dy- 
namics 

The extended variant of the EDDy cipher uses the same input 
information as above, i.e. a binary plaintext message m = s(Q) 
and a key K = {P, r, T). Using the same notation as above, the 
ExEDDy cipher reads 

s t (f + 1) = sp,(max(0, t - r,)) • fl( *i(0)- (2) 

Therein, #(•) is a step function satisfying 



0(x) 



+ 1, ifjc>0, 
-1, if jc < 0. 



(3) 



As opposed to the EDDy scheme, this causes a nonlinear dy- 
namics since an arbitrary bit at time step t (explicitly) depends 
on all TV bits at time step t — 1. Fig.[2jb) illustrates an exemplary 
encryption procedure for the ExEDDy cipher. 

2.3. ReCA: encryption via reversible cellular automata 

Cellular automata (CA) are abstract computing models that 
work on a discrete space-time background. They exhibit com- 
plex dynamics and might be interpreted as discrete structures 
that approximate differential equations [11]. As such, CA high- 
light the close connection between the realms of computer sci- 
ence and physics B12l 1 1 3L 1 1 411 . Further, there is a possibility 
to use CA as cryptosystems for the purpose of data encryption 
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Figure3: List of the 8 possible configurations s,-i(f), s,(f), $i+i(t) for a radius 1 
CA, that might serve as input to the local update rule /. The configurations are 
interpreted as 3 digit binary numbers (bits with value 1 are shown as nonfilled 
squares) and sorted in decreasing fashion from left to right. The 8 solitary 
cells below cell i indicate the state Sj(t + 1) = /[i;-i(f), .«;+i(? + 1)]. The 
respective 8 bit sequence fully specifies the update rule. In Wolfram's notation, 
the integer representation of the latter sequence is used as a name R for the rule 
(here: R = 150, which represents the most simple finite difference variant of 
the heat equation in modulo 2 arithmetic II IIP . 



The most basic CA [13] consist of a circular array s of, say, 
TV cells that can take values s t £ (0, 1) for all i e (0, . . . , N - 1). 
The evolution of CA proceeds in discrete time steps f, where 
the values of the individual components s,(f) are updated syn- 
chronously according to a certain local update rule. So as to 
evolve state s,(f) — > s,(f +1), the local update rules / con- 
sidered in the presented article take into account the state of 
cell i as well as the states of those cells that are located within 
a neighborhood of radius r — 2 enclosing i at time t, hence 
Si(t + 1) = f[si-2(t), ■ ■ ■ , Si+2(t)] (note that the array of cells is 
circular, i.e. cells and TV- 1 are adjacent). Considering a neigh- 
borhood of radius r, there are an over all number of 2 2r+l dif- 
ferent input configurations to /. Hence, the local rule for a one- 
dimensional radius 2 CA is specified by a 2 5 = 32-digit binary 
number. In turn, there are 2 32 different CA rules for the speci- 
fied setup. A more simple example of a local rule for a r — 1 
CA is shown in Fig. [3] Therein, also the name convention for 
CA rules is detailed. Note that in general, CA are not time re- 
versal symmetric, a feature one would request in order to set up 
a convenient dynamics for encryption as well as its reverse dy- 
namics for decryption Nevertheless, such basic CA might 
already be used as stream ciphers J2,[3]. It is important to note 
that there is a possibility to transform any (non-reversible) rule 
into a time reversal invariant rule. For a CA with a binary state 
alphabet and r — 2 neighborhood, the recipe to achieve this sim- 
ply reads: Si (t + 1) = (f[Si- 2 (t), ■ ■ ■ , s i+2 (t)] - si(t - l))mod(2) 
1 1 lfl - Note that the modified rule is second order in time, i.e. so 
as to start the dynamics of the CA one has to provide a configu- 
ration s(t = 0) and its predecessor s(— 1). The intriguing feature 
of time reversal invariance is: a sequence of configurations can 
be obtained in reverse order by means of the same rule /[•], by 
reversing the last two configurations. In effect, this is the core 
idea of encryption via reversible C A (ReCA) 16[] . 

In order to use ReCA for the purpose of data encryption, 
one has to supply two ingredients: (i) the input data, where 
s(0) = m, and some random initial data (rid) taken as s(— 1) so 
as to be able to start the ReCA dynamics, (ii) a key that gov- 
erns the encryption dynamics, given by an updating rule that 
specifies the evolution of the state s(t) — > s(t + 1) and a num- 
ber T of iteration steps, after which the ciphertext is obtained. 
Note that for such a ReCA cipher, the full ciphertext consists 
of two sequences: s(T) which is identified with the ciphertext 
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c, and the final encrypted data (fd) s(T + 1). An exemplary en- 
cryption process using a ReCA algorithm is illustrated in Fig. 
[2jc). Decryption using ReCA is particularly simple: upon set- 
ting s'{0) = s(T), s'(-l) = s{T + 1), and using the same key 
as during encryption, it will hold that s'{T) = m. The configu- 
ration s'(T + 1) contains the random initial data and as such, it 
is not of interest after decryption. However, it might be used as 
an additional degree of freedom: upon using a particular key, 
a given plaintext message can be scrambled into numerous ci- 
phertexts, depending on the random initial data. So as to real- 
ize secure communication using this approach, there are some 
subtleties concerning the communication of the finial encrypted 
data, see Ref. [6]. However, the focus here is on the principal 
dynamics of the encryption schemes. 

The subsequent section presents the results of the numeri- 
cal simulations and attempts to give some more intuition on the 
principle dynamics on which the considered encryption algo- 
rithms are based. 

3. Results 

In the presented section, the encryption process, wherein 
a plaintext message m is scrambled using a certain cipher F 
(either EDDy, ExEDDy or ReCA) and key K, is put under 
scrutiny. The result of the encryption procedure is a cipher- 
text message c, and the process might be written as c = F^(m). 
In order to probe the avalanche criterion (the precise definition 
of the avalanche criterion is given below in Subsect. 13.2b for a 
given cipher F, a three step procedure is adequate: Obtain a 
random key K (valid for F), then (i) generate a random binary 
plaintext message, N bits in length, and obtain the correspond- 
ing ciphertext c, (ii) flip one bit, say bit ;«,, of the plaintext 
message to obtain a perturbed plaintext m U) and obtain the cor- 
responding ciphertext c", (iii) compute the Hammingdistance 
du(c, c w ) between the two ciphertexts, defined as the number 
of differences between the components of c and c w . For binary 
sequences c and c w of N bit length and using Boolean notation, 
the Hammingdistance may be written as 

d H (c,c (i) ) =# 1 (c©c (i) ). (4) 

Therein ffi denotes the logical xor-operation, and #i(c) signifies 
the number of occurrences of the digit 1 in the binary represen- 
tation of c. 

For a given plaintext of length N, the results are then av- 
eraged over different plaintexts m and keys K. In this regard, 
for N < 10 and for a particular key, it is feasible to consider 
the full input alphabet consisting of 2 N distinct plaintext 
messages. Here, a number of 200 different keys was taken 
into account in order to compute averages (dn(jc, c w )) m ^. For 
N > 10, tuple consisting of a plaintext and a key were sampled 
uniformly at random from among all possible choices. Further, 
the "equiprobable ensemble", featuring binary messages with 
probability p = 1/2 for bits in state 1, was considered. In this 
case, a number of 400 plaintext/key pairs was used so as to 
compute averages. 

In the remainder of the presented section, the dynamics of 
the encryption prosess is considered. In this respect, in the first 



subsection evidence is collected on whether plaintext and ci- 
phertext blocks, obtainded via the different encryption dynam- 
ics, are statistically independent. For this purpose, a «-block 
frequency test (note that the frequency test carried out above 
resembles the monobit frequency test suggested by NIST lfl5ll 
to check the randomness of binary sequences. Here, instead of 
monobits, bytes are considered.) is employed, a compression 
test is performed, and a measure of (structural) complexity for 
sequences of encoded states is considered. The respective sub- 
section is closed by a simple graphical correlation analysis re- 
garding successive encoded states. The subsequent subsection 
explains and quantifies the avalanche parameter for the consid- 
ered ciphers. Therefore, the evolution of the plaintext is con- 
sidered and the stationary behavior of the avalanche parameter 
is examined. The presented section concludes with a note on 
completeness for the different encryption schemes. 

3.1. Dynamics of the encryption processes for the considered 
ciphers 

A given cryptosystem provides perfect secrecy, if the plain- 
text and ciphertext blocks processed by the cipher are statisti- 
cally independent |l||. Here, the principle dynamics of the en- 
cryption process is considered by monitoring the evolution of 
plaintext messages during the encryption process. Therein, the 
aim of the presented subsection is to employ various tests on 
the three ciphers introduced above, to check if the sequence of 
encoded configurations exhibits obvious statistical regularities. 
To perform the necessary tests, a large number of up to T « 10 4 
iteration steps are used with the respective ciphers. Albeit this 
might be infeasible for any practical cryptographic application, 
it is nevertheless useful as far as the principle dynamics of the 
algorithms is considered. Further, so as to contrast the results on 
the three ciphers above, a Id CA with r — 1 neighborhood that 
implements Wolfram rule 30 (denoted as R30) is considered. 
R30 generates effectively random bit sequences and might be 
used as a stream cipher for cryptographic purposes, see Refs. 
1 2[ Il411. As such, it has already passed a series of statistical tests 
1 16|] and is solely considered for the purpose of comparison. 

n-block frequency test for configurations during encryption. At 
first, the statistics for a sequence s(t) of encrypted binary con- 
figurations, obtained during the encryption process, is put under 
scrutiny. The basic question is whether the resulting statistics is 
compatible with that for sequences of effectively random con- 
figurations. A proper tool to check this is a «-block frequency 
test. This test can be cast into the following three step proce- 
dure: (i) slice the N bit input configuration s(t) for a given step t 
into a number of M = \_N/n\ n-bit blocks \bj}f =y , and discard all 
remaining bits. Then, follow the "evolution" of the input con- 
figuration up to to + At iteration steps, where the configurations 
obtained during the first to = N iteration steps are skipped (the 
value of to is picked rather arbitrarily, it is ment to eliminate 
possible effects of the initial "short-time" dynamics). Repre- 
sent each w-bit block b, by means of its integer decimal value 
ld[bj] e (0, ... ,2" - I), and accumulate the resulting integers in 
a histogram j/z, } having 2" bins with id i e (0, . . . , 2" — 1). The 
bins then contain the observed frequencies hi associated to the 
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Figure 4: Result of the n-block frequency analysis. The pdf shows the dis- 
tribution of the ration of frequencies {hf/e^X 1 for n = 8. The distributions 
resulting from ExEDDy, ReCA and R30 dynamics compare well to a Gaussian 
distribution with mean /j = 0.999(2) and width <x = 0.047(1) (obtained from a 
fit to the ReCA data and illustrated by the dashed line). This already leads to 
expect that the histogram of observed frequencies is rather "flat". The distri- 
bution related to the dynamics of the EDDy cipher suggests that for EDDy, the 
above conclusion is certainly not appropriate. 



integer numbers i. For effectively random sequences one would 
expect to find each integer id with probability 2~", hence the ex- 
pected frequencies are simply given by e,- = A/ samp x 2~" wherein 



Nsamp = MAt. Now, if the encrypted configurations exhibit the 
statistics of random binary sequences, the histogram [hi] should 
be "flat" with each bin having the same expected frequency. 
Consequently the null hypothesis reads: "The sample follows a 
uniform distribution", (ii) Probe the x 2 statistics, and, so as to 
check the null-hypothesis compute the associated p-value, see 
Ref. Jl7ll . (iii) Finally, reject the hypothesis if p < 0.01. I.e., 
if p > 0.01, the sample follows the assumption that the his- 
togram is flat. The ,y 2 -test described in steps (ii) and (iii) above 
was carried out for N = 128-bit input sequences regarding four 
different dynamics given by the EDDy, ExEDDy, and ReCA ci- 
pher, as well as the R30 dynamics. In the analysis, Af = 10 3 and 
blocks of n — 8 bits in length, i.e. bytes, where considered. The 
results of the analysis are listed in Tab. [T]and probability density 
functions (pdfs) for the ratio of the observed/expected frequen- 
cies related to the four different dynamics are shown in Fig. [4] 
To summarize the findings: while the configurations obtained 
using the ExEDDy, ReCA, and R3Q dynamics exhibit statistics 
compatible with those of random sequences, the computed p- 
values clearly suggest that EDDy gives rise to seemingly non- 
random sequences of configurations during encryption. 

An oversimplified compression test for the sequences of en- 
coded states. Besides checking whether the sequence s(t) of 
encrypted configurations exhibits the same statistics as truly 



random sequences, it is also of interest to look for structural 
regularities. As regards this, here, an oversimplified compres- 
sion test using the convenient Unix-tool gzip is performed. 
As a prerequisite for the test, for each of the three encryption 
algorithms and the R30 dynamics, a number of 100 plaintext 
messages (128 bits in length) is evolved for 10 3 iteration steps. 
Again, R30 is considered for comparison only. The evolution 
of each plaintext is stored in a single file. Prior to compression, 
the individual files have a size of, say, Bo bits. The gzip data- 
compression tool uses the Lempel-Ziv (LZ77) algorithm iflill . 
so as to reduce the size of the supplied data. Loosely speak- 
ing, LZ77 works by finding sequences of data that are repeated 
and exploits those "patterns" to perform the compression pro- 
cess. After compression via gzip, the size of a given file is 
reduced to B gz i P . Then, the compression factor k = B gz i P /Bo 
for each file is computed and its mean and standard error are 
listed in Tab. Q] As it appears, (k) is approximately equal for 
the ExEDDy, ReCA and R3Q data, while it assumes a slightly 
smaller value for the EDDy data. This indicates that, compared 
to the other encryption schemes, EDDy exhibits a larger degree 
of structural regularity. 



A measure of the degree of randomness for the sequences of 
encoded states. So as to elaborate on the degree of structural 
regularity, data compression algorithms can also be used to esti- 
mate further statistical properties of a given sequence x of sym- 
bols. E.g., one might design a measure for the algorithmic ran- 
domness associated to x via non-sequential recursive pair sub- 
stitution (NSRPS) HUSIllt]. In order to illustrate the NSRPS 
method, consider a sequence Xq of symbols, composed of char- 
acters stemming from a finite g-symbol alphabet A — {aif i=Q l . 
An elementary step of the NSRPS algorithm, referred to as pair 
substitution, might be illustrated as two step procedure: (i) For 
a given sequence xq, determine the frequency of all (ordered) 
pairs e e Ax A with respect to xo and identify e m f p , i.e. the most 
frequent (ordered) pair of symbols. If the most frequent pair is 
not unique, signify one of them as e m f p . (ii) Construct a new 
sequence X\ from xq wherein each full pattern e m f p is replaced 
by a new symbol a q (for this purpose, xo is scanned from left to 
right), and augment A with a q . The new sequence is shorter in 
length and the size of its associated alphabet is incremented by 
1 . This pair substitution step might be executed iteratively, un- 
til the representation of the sequence requires a single character, 



Table 1: From left to right: Type of dynamics, ^- 2 /dof and p- values, resulting 
from the n-block frequency analysis, compression factor k obtained using a 
simple data compression test, and minimal number iVp S of pair substitution steps 
needed to transform a sequence of bit states into a constant sequence. For the 
latter quantity, the values in the braces list the standard deviation. 
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Figure 5: Results for a repeated application of the pair substitution process 
on bit strings, obtained by monitoring the states of the individual bits of a 128 
bit plaintext message during an exemplary encryption process that took 10 3 
encryption steps. Hence, there are 128 individual bit strings (corresponding to 
the 128 lines in the figure), each of which is initially 10 3 symbols in length. 
The figure shows the parameter C, which might be used to indicate whether a 
constant sequence is obtained during iteration (in that case, it holds that C, = 0). 
As discussed in the text, the application of the NSRPS algorithm allows to 
define a measure of complexity associated to a given sequence of symbols. 



only. Such a sequence has zero information entropy 



H(x) 



(=0 



(5) 



wherein n, specifies the observed frequency of symbol a, in the 
sequence x of length N, and is called a constant sequence. Here, 
as a measure of algorithmic randomness associated to the initial 
sequence Xq, the minimal number of pair substitution steps N ps , 
needed to transform xo to a constant sequence with H(x^) = 0, 
is considered. In order to facilitate intuition, consider the 6 
bit sequence x = 110010. An iterative application of the pair 
substitution step on x yields the result: 



step i 


Xi 


H( Xi ) 


^mfp 


a 





110010 


1.0 


10 


2 


1 


1202 


1.5 


02 


3 


2 


123 


1.58 


23 


4 


3 


14 


1.0 


14 


5 


4 


5 


0.0 







I.e., after A^p S = 4 steps, the NSRPS algorithm terminates for the 
constant sequence x\ — 5. For the slightly different sequence 
y = 101010 (also with initial entropy H(y ) = 1), the NSRPS 
algorithm terminates after a single pair substitution step, where 
the constant sequence reads y\ = 222. One may now conclude 
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Figure 6: Typical result for a graphical correlation analysis for subsequent 
configurations s(t) and s(t + 1) obtained using the encryption dynamics based 
on (a) EDDy, and (b) ExEDDy (using the same plaintext and key as (a)). In 
the figure, a particular binary configuration s(t) is represented by means of its 
integer decimal value Id[s(f)] ■ The results for the ReCA cipher look similar to 
those of ExEDDy and are not shown. 



that sequence x exhibits a higher degree of randomness than se- 
quence y, since the NSRPS algorithm requires more elementary 
pair substitution steps in order to arrive at a constant sequence. 
This is in accord with intuition, since, in contrast to sequence 
x, y shows a regular pattern. 

In Fig. [5] results for a repeated application of the pair sub- 
stitution process on 128 individual bit strings, each of which is 
10 3 bits in length, are shown. The bit strings are obtained as 
follows: a 128 bit plaintext is prepared and subsequently en- 
crypted using 10 3 encryption steps. Each individual bit of the 
plaintext is monitored during the encryption process so as to 
yield a bit sequence that is 10 3 bits in length. More precise, the 
figure illustrates the evolution of the parameter C, = L, x H(x,) 
for each of the 128 individual bit strings (each of which initially 
is 10 3 symbols in length), wherein L,- signifies the length of the 
sequence at iteration step i. Results are shown for the EDDy 
and ExEDDy ciphers, only. Upon execution of the NSRPS al- 
gorithm, the parameter value C,- = might be used as a stop- 
ping criterion to detect whether a constant sequence is obtained 
1 2111 . Here, the application of the NSRPS algorithm to each 
bit string sheds some light on the "internal" dynamics of the 
encryption schemes. Consider, e.g., the EDDy cipher: as ev- 
ident from Fig. [5] there are some bit strings that transform to 
constant ones almost immediately, while there are others that 
last for quite a large number of iteration steps. The reason for 
this has an intuitive appeal: during an encryption process using 
EDDy, the dynamics of a given bit is only coupled to those bits 
that are located along the same cycle in the cycle decomposi- 
tion of the index-permutation P that forms part of the key (see 
discussion below). Hence, the encryption dynamics of EDDy 
for a plaintext of a given size can be decomposed into indepen- 
dent dynamics taking place on the set of cycles in the cycle- 
decomposition of P. Depending on the particular delay-times 
that characterize the bits in such a cycle, the respective dynam- 
ics might turn out to be rather regular. This can most easily be 
seen for a fixed point p, = i of the permutation P: once the 
dynamics s,-(f) = -s,(max(0, t - t,)) is kicked off, the state of 
the respective bit changes with period t,-. For the simple case 
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where t, = 1, the sequence of the state of that particular bit 
reads just 01010101 . . . (given that 5,(0) = 0), and the NSRPS 
algorithm will terminate after a single step. Similarly, a delay 
time Tj = 2 might yield the sequence 001 1001 1 . . ., keeping the 
NSRPS algorithm busy for 3 steps. Somewhat "less regular" 
patterns are found for cycles that are larger in length. Conse- 
quently, a widespread distribution of the pair substitution steps 
A ps , needed to obtain a constant sequence, is observed. The 
average number of such pair substitution steps, taking into ac- 
count 200 different 128 bit plaintexts, that where evolved for 
10 3 iteration steps each, is listed in Tab. [TJ The results for the 
ExEDDy cipher are completely different: the fates of the indi- 
vidual bit sequences upon application of the NSRPS algorithm 
appear to be less diverse, see Fig. [5] In comparison to the results 
obtained for EDDy, this is manifested by a smaller standard de- 
viation associated to (A ps ), as listed in Tab. [JJ The results for 
the ReCA cryptosystem and R30 dynamics are listed in Tab.Q] 
also. They look similar to those obtained for ExEDDy and are 
thus not shown. 
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Graphical analysis of correlations between successive encoded 
states. One may further wonder whether the sequence s(t) 
obtained during encryption exhibits correlations with respect 
to, e.g., subsequent time steps. In order to check this, it is 
most simple to label a configuration at a given time step t by 
means of its integer decimal representation Id[s(f)] and to plot 
Id[s(f + Af)] as function of Id[s(f)]. Such a graphical corre- 
lation analysis for the evolution of one random 16 bit plaintext 
message is illustrated in Fig.|6ja) and (b), following the encryp- 
tion dynamics of the EDDy and ExEDDy ciphers, respectively. 
Therein, the correlation between subsequent configurations, i.e. 
At = 1, was considered. As evident from the figure, EDDy 
exhibits a statistically rather regular behavior, which might be 
attributed to its linear dynamics, whereas ExEDDy and ReCA 
exhibit no obvious regularities for Af = 1 (the results for the 
ReCA dynamics look similar to those of ExEDDy and are not 
shown). Further, the regular pattern generated by EDDy sug- 
gests a rather short cycle length for its dynamics. 

3.2. Quantifying the avalanche parameter for the considered 
ciphers 

The avalanche criterion would require to check whether 
(d H (c,c (i, )} m , K « 1/2 for each i e (0,...,N - 1). Here, the 
bits are thought of as equivalent entities, thus, in the remainder 
of the presented section, only one flip for each plaintext is at- 
tempted. This means, step (ii) above yields a modified plaintext 
m! (where the flipped bit is chosen uniformly at random), for 
which c' = Fx(m r ) and it is only checked whether (dn(c, c'))m,A" 
agrees with the desired value 1 /2 within errorbars. If the latter 
requirement is satisfied, the respective cipher is said to exhibit 
the avalanche property. Subsequently, the Hammingdistance, 
averaged over different plaintext messages m and keys K, i.e. 
(dn(c, c'))m,AT, is referred to as avalanche parameter. 

Evolution of the Hammingdistance upon modification of the 
plaintext. Regarding the EDDy cipher, the Hammingdistance 
(du(c,c')),„ K, interpreted as a function of the iteration steps 



Figure 7: Results for the Hamming-distance (d\i(c,c')) m k as function of the 
number of iteration steps t, obtained for the different encryption algorithms. 



t carried out by the encryption dynamics, fluctuates around 
a value of Af -1 for all considered plaintext lengths N. Fig. 
|7] illustrates the results at N — 32, where the distribution of 
the distance-values (du(c, c')) m ^, collected over an appropri- 
ate number of iteration steps, follows a Gaussian distribution 
with mean value fi(d]f) » 0.031 and width cr(du) ~ 0.001 (not 
shown). The argument for such a small mean value is quite 
plausible: Consider, e.g., a 6 bit plaintext, encrypted by using a 
key containing the index-permutation P = (3, 4, 2, 0, 5, 1). The 
respective cycle decomposition reads (2)(3, 0)(4, 5, 1). As a re- 
sult, the ciphertext-bit C5 is only affected by a finite number 
of plaintext-bits, namely bits m.4 and m.\. Now, if the value 
of a single bit in the plaintext is changed, say m' 5 = -1115, 
the difference in the evolution of the altered plaintext will be 
confined to the cycle (4,5, 1) only. This is illustrated in Fig. 
Ufa), where the difference between two configurations c and 
c', i.e. c © c', during an encryption process using EDDy is 
monitored. Therein, the encryption processes was started at 
two plaintexts that differed only in the value of the center bit. 
In the analysis, if the flipped bit is chosen uniformly at ran- 
dom, the length of the corresponding cycle is best fit by the 
expression <4> = 0.49(1 )(N - 0.9(2)) 1003(4) « N/2 (where the 
probability mass function for cycles with length { behaves as 
n(£) oc (r x , measured for permutations P of length N = 128; 
not shown). Now, the length ( c of a particular cycle sets an 
upper bound for the Hammingdistance, giving rise to the re- 
striction {du(c,c')) m K < 1/2. Apparently, since the difference 
c ffi c' typically stems from only a small number of bits con- 
tained in the respective cycle (see Fig. |8ja)), it appears that on 
average [(dn(c, c'))m,/dr ~ N~ l for all N considered (see Fig. [9] 
and discussion below). 

As evident from Fig. [7] the behavior of the ExEDDy cipher is 
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Figure 8: Exemplary plots that illustrate the evolution of the difference c ® c' 
between two ciphertexts c = ficim) and c' = fg(m'), where initially m and 
m' differed only in the value of the centered bit. Nonfilled squares signify 
bits for which the values in the two configurations are different. Results for 
encryption dynamics based on (a) EDDy, (b) ExEDDy (using the same key as 
(a)), as well as (c) isotropic spread, and (d) anisotropic spread of the difference 
obtained using the ReCA cipher. The length of the plaintext was N = 41 and 
the evolution was followed over 40 iteration steps of the particular encryption 
dynamics. 



completely different: the Hammingdistance initially increases 
but saturates at a value slightly below 1 /2. Related to this, Fig. 
Ob) illustrates the difference between two configurations that 
initially differed only in the value of the center bit. Considering 
a CA with a neighborhood of radius r — 2, an initial change 
in plaintext, i.e. at time t — 0, may affect at most 2rt + 1 cells 
at time t, implying that dn < (2rt + 1)/N. Therein, the value 
of r defines an intrinsic "velocity", measuring the number of 
cells per time-step, by means of which a change is transmit- 
ted through the CA array. However, note that this is merely an 
upper bound, the actual velocity depends on the precise updat- 
ing rule implemented by the CA and might also be anisotropic 
(cf. rules 30 and 60 for elementary cellular automata 12211 '). To 
illustrate this, Figs. [8]c),(d) show the difference between two 
configurations that initially differed only in the value of the bit 
at the center, based on the ReCA cipher. Then, for the ReCA 
dynamics one can expect an approximate linear increase of du 
during the initial stage of the encryption dynamics. In deed, a 
fit using a functional form {da{c,c')) m ^K = (u ■ t + 1)/N yields 
the result u = 1.112(1) at N - 256. Analysis of the initial 
dynamics for further plaintext lengths N = 4, ...,512 yield 
qualitatively similar results (not shown). Hence, after t « N/2 
time steps a change of one bit in plaintext leads to a distance 
(dn(c, c'))„ u k ~ 1/2 between the ciphertext corresponding to 
the perturbed/non-perturbed initial message, see Fig. [7] This 
finding compares well to the observation reported in Ref. |@], 
where for a r = 2 CA with 32 (64) cells a minimum number 




Figure 9: Avalanche parameter resulting from a flip of a single plaintext bit as 
a function of the plaintext bit-length N. Nonfilled symbols indicate an average 
over the full input alphabet, while the filled symbols refer to a stochastic sam- 
pling of plaintext messages. Error bars display the standard error associated to 
the data points. The inset shows a zoom in on the ExEDDy and ReCA results 
for small plaintext lengths. 

of 19 (38) iterations of the encryption dynamics was recom- 
mended. 

Stationary behavior of the avalanche parameter. So as to quan- 
tify the stationary behavior of the avalanche parameter, it is 
useful to distinguish the kind of modification imposed on the 
encryption process. In this regard, the presented analysis dis- 
tinguishes between (i) a modification of the plaintext, where a 
single bit of the plaintext is changed (the bit is chosen uniformly 
at random), and (ii) a modification of the key. In the latter case, 
the focus is on the EDDy/ExEDDy ciphers only. 

As regards (i), the avalanche parameter for the EDDy cipher 
(averaged over the iteration steps t) shows the clear scaling be- 
havior [(dn(c, c')) m ^]t K 1 for the full range of the consid- 
ered plaintext bit-lengths N, see Fig. [9] This is in accord with 
the observation above, where the evolution of the Hammingdis- 
tance during an encryption process was considered. The behav- 
ior of the ExEDDy cipher is strikingly different: the value of 
the avalanche parameter, averaged over iteration steps t > 200, 
is only slightly smaller than 1 /2, see Fig. [9] E.g., the numerical 
value [(d H (c, c')) m<K \, = 0.482(5) attained at N = 32 is only 3.5 
standard deviations below the desired value. Given the apparent 
similarity of the two encryption schemes, this is a considerable 
improvement over EDDy. The ReCA based cipher appears to 
yield the best results: while there are slight deviations from the 
desired value for small plaintext sizes N < 9 (e.g., at N = 8 the 
numerical value [(dn(c, c')) m ,K]t = 0.496(2) of the avalanche 
parameter is 2 standard deviations below 1/2) the value of the 
avalanche parameter is compatible with 1 /2 for all values N = 
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Figure 10: Avalanche parameter resulting from swapping two entries of the 
index-permutation P (illustrated by the main plot), and choosing a bit (uni- 
formly at random) and replacing its associated delay-time by a new one (shown 
in the inset). The abscissa indicates the length N of the plaintext. Nonfilled 
symbols indicate an average over the full input alphabet, while the filled sym- 
bols refer to a stochastic sampling of plaintext messages. Error bars display the 
standard error associated to the data points (for the filled symbols, the symbol 
size is larger than the error bars). The solid horizontal line indicates a value of 
[{d H (c,c')) mX ] t = 1/2. 



see inset of Fig. \TU\ In conclusion, a modification of plaintext 
or index permutation leads to quite similar numerical values for 
the associated avalanche parameters. In comparison, a modi- 
fication of a randomly chosen delay time results in somewhat 
smaller values of the avalanche parameter. 

3.3. A note on completeness 

As pointed out above, the encryption dynamics of EDDy for 
a plaintext of a given size can be decomposed into indepen- 
dent dynamics taking place on the set of cycles in the cycle- 
decomposition of P. As a result, the dynamics of a given bit 
is only coupled to those bits that are located in the same cy- 
cle of the cycle decomposition. This means that typically, a 
given ciphertext bit depends on a few plaintext bits only. Thus, 
the linear dynamics provided by EDDy lacks completeness (as 
explained in the introduction). The situation is different for 
ExEDDy: since each bit depends on the sum of states of all 
bits in the previous time step, completeness is trivially satisfied. 
Also, if the dynamics of the ReCA encryption algorithm is iter- 



ated for t„ 



> 



N 12 time-steps, each bit in ciphertext might be 



affected by a given bit in the plaintext message. Note that this 
argument was established from a statistical point of view (as 
discussed above), the precise value of f m ; n depends on the par- 
ticular key used during the encryption process. Further, bear in 
mind that, as discussed above, a lower bound on the respective 
time scale for a r — 2 CA is given by t — N/4. Hence, ReCA 
exhibits completeness after a certain (key dependent) minimal 
number of time-steps. 



9 ... 64 (e.g., at N = 64 one finds [<d H (c, c')) m , K ], = 0.498(3)). 
The results for the ReCA cipher where averaged over iteration 
steps t > 350. 

Considering a modification of the key and focusing on the 
EDDy and ExEDDy cryptosystems, a further distinction is 
drawn between altering the permutation P and the delay-time 
vector t. Regarding the former modification, two randomly 
chosen entries are swapped, while in the latter case a single 
bit is chosen uniformly at random and the associated delay time 
is redrawn from the interval [l,r max ]. In both cases, the re- 
sults for the EDDy cipher are best fit by powerlaw functions of 
the form [(d H (c, c')) m , K ], <x (N + AN) a , where AN ~ 265 and 
a = -1.29(6) for a change in P, see Fig.[l0] and AN ~ 65 and 
a - -1.09(3) for a change in t, see inset of Fig. [10] Conse- 
quently, in the limit of large N, the effect of a minimal change 
in the plaintext on the ciphertext is negligible. The precise nu- 
merical values of [(dn(c, c')) m ,/rL m the range N = 24 . . . 2048 
are about 2-5 standard deviations below 1 /2. 

For ExEDDy, however, results are completely different: upon 
swapping two random entries of the index-permutation, the 
avalanche parameter (averaged over iteration steps t > 200) is 
only slightly below 1/2, see Figs. [10] As regards this, the nu- 
merical values of [(dn(c, c'))m,A:]r in the range N = 24 . . . 2048 
are about 2-5 standard deviations below 1/2. Further, changing 
one randomly chosen delay-time yields an avalanche parameter 
(averaged over the data for t > 200) clearly smaller than 1 /2, 



4. Conclusions 

In the presented article, the encryption process of three dif- 
ferent cryptosystems for block-encryption, i.e. EDDy, ExEDDy 
(an extended variant of EDDy) and ReCA, is put under scrutiny. 
While EDDy and ExEDDy are based on the paradigm of de- 
layed dynamics, ReCA relies on the updating rules provided 
by reversible cellular automata. Starting from an initial plain- 
text message, all three cryptographic schemes iteratively pro- 
cess the plaintext, yielding a sequence of encoded configura- 
tions until, finally, the ciphertext is obtained. Upon analysis 
of the statistical properties related to the sequence of encoded 
configurations, it was found that the EDDy cipher gives rise to 
a statistically rather regular behavior: the sequence of encoded 
configurations does not exhibit the properties expected for ef- 
fectively random sequences. For the purpose of comparison, 
effectively random binary sequences produced by a certain Id 
CA, referred to as R3Q, were considered. Further, EDDy does 
not satisfy the avalanche criterion (neither for a modification of 
plaintext nor a modification of the key) and it lacks complete- 
ness. In contrast to this, the ExEDDy cipher clearly outper- 
forms EDDy in all test considered. The statistical properties of 
the sequence of encoded configurations are in good agreement 
with those of the ReCA cipher and the R30 dynamics. ExEDDy 
does not strictly satisfy the avalanche criterion but performs 
reasonably well. Further, it features completeness. Given the 
apparent similarity of the algorithmic procedures that underlie 
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both delayed-dynamics based ciphers, ExEDDy constitutes a 
striking improvement over EDDy. Finally, the statistical prop- 
erties of the sequences of encoded configurations that are ob- 
tained during an encryption process using the ReCA cipher are 
in excellent agreement with those obtained for the R30 dynam- 
ics. From the analysis of plaintexts with bit-size N = 4 ... 64 it 
is obvious that ReCA satisfies the avalanche criterion (in sup- 
port of Ref. 0, where 32 and 64-bit plaintexts are considered 
only). Further, the ReCA cipher shows completeness after a 
key-dependent minimal number of iteration steps. 

Another issue of interest from a point of view of application 
is the size of the full ciphertext, relative to the plaintext. As 
regards this, the three cryptosystems considered here lead to 
data expansion. As pointed out in subsect. l2~Tl the key space of 
the delayed dynamics based cryptosystems increases with the 
maximal delay time as oc (r max ) A ', ensuring a high level of se- 
curity for large r max . However, note the fiipside to that coin: 
the minimal size of the full ciphertext that is necessary for de- 
cryption increases as (r max + 1)xjV and thus depends on the 
parameter r max as part of the key. In contrast to the delayed 
dynamics ciphers, the size of the full ciphertext for the ReCA 
cryptosystem is always 2xN. To the knowledge of the author, 
the cryptographic schemes discussed in the presented article are 
of academic interest. The respective encryption dynamics are 
goverend by rather basic model dynamics that, without doubt, 
are interesting in their own right since they give rise to a very 
complex behavior and eventually exhibit properties that can be 
exploited so as to set up a working encryption algorithm. How- 
ever, so as to implement a full cryptographic method that allows 
for encryption and decryption of data, a rather large key is nec- 
essary and the ciphertext may turn out to be considerably larger 
in size than the plaintext (also known as data expansion). These 
effects somehow limit the practicabillity of the discussed cryp- 
tographic schemes. 
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